Slack says it is resetting passwords for 1% of its users after receiving new info about the company's 2015 security breach; in April, Slack said it has 10M DAUs
Context & Ripple Effects
The password resets land on a user base that has grown roughly sixfold since the breach itself: Slack counted just 1.7M daily active users in late 2015, when the intrusion occurred, versus the 10M+ DAUs and 85,000+ paying customers it reported in January 2019. Credentials exposed four years ago are only now being rotated for a slice of that much larger population.
It also extends a security narrative that follows Slack across its scaling years — from the 2015 breach to the later desktop app remote-code-execution flaw Slack fixed for a $1,750 bounty that drew public criticism — at a moment when the company is courting large enterprise accounts.
First-order effects
- Roughly 100,000 users — 1% of the 10M daily actives Slack cited in April — must set new passwords immediately, and any of them still using 2015-era credentials elsewhere inherits the exposure.
- Slack absorbs the support and messaging cost of contacting affected users about a four-year-old incident, on top of whatever forensic work the 'new information' triggered.
Second-order effects
- Enterprise buyers evaluating Slack against rivals now have a documented pattern — an old breach plus a low-bounty critical bug — that security review teams weigh during procurement, giving competitors a talking point in deals where trust is the tiebreaker.
- The episode pressures other collaboration platforms to re-examine whether credentials from their own early-growth years were fully remediated, since resurfaced breach intelligence can force similar mass resets on them.
Third-order effects
- If this pattern holds, a company's pre-scale security debt becomes a recurring liability that matures alongside its valuation: incidents from the startup years keep generating present-day remediation, disclosure, and procurement friction well after the technical fix.
- Workplace software firms increasingly get audited on their full incident history rather than current posture alone, making early-stage security investment a structural requirement rather than a discretionary one.
The trend: As collaboration platforms scale into core enterprise infrastructure, security incidents from their early growth years keep resurfacing as costly, reputation-bearing obligations years later.